February 20, 2015 By Shane Schick 2 min read

As if it weren’t already overwhelming enough to gather all the necessary financial statements and fill in the various forms to prepare a tax return, cybercriminals are now making matters worse with a spear phishing scam that has drawn the attention of the U.S. Internal Revenue Service (IRS).

In a statement posted on its website, the IRS said it has learned of taxpayers who have been receiving phony emails that instruct them to visit a portal to update information in order to “e-file” their returns. Though the websites in question may resemble that of the IRS, they are more likely spear phishing scam sites designed to capture personal and professional information.

Email isn’t the only attack vector cybercriminals are using. According to a column in the Washington Post, some taxpayers are also receiving bogus voicemail messages threatening legal action if information is not handed over. Even a lawyer with U.S. Federal Trade Commissioner was among those targeted.

In some respects, it makes sense that spear phishing scams would eventually tie in to something like tax season, which has numerous deadlines to meet and all kinds of details that could easily be missed or overlooked. From a social engineering perspective, there is plenty of reason why unsuspecting citizens might worry they need to update information in order to get their returns processed correctly.

CSO Online recently provided one of the best summaries on how tax-related spear phishing schemes tend to work, with detailed screenshots of the typical email formats used and the kinds of portals designed to steal personal data. Besides the fact that the IRS would not contact taxpayers electronically for these purposes, other telltale signs include messages that don’t specify the recipient by name or email attachments that require a download in order for taxpayers to take the next step.

Forbes had some interesting ideas on how to ensure you’re not fooled by spear phishing scams, including filing tax returns earlier or later than is typical. In any case, anyone who experiences suspicious contact from an organization that purports to be the IRS is being urged to report it using the [email protected] email address.

Besides causing a nuisance, a spear phishing scam like this opens the door to identity theft and possibly worse. Perhaps if cybercriminals begin to make a habit of capitalizing on tax season, taxpayers will become savvy enough to know what to expect and be less likely to fall victim to it. As the old adage says, nothing is certain but death and taxes — cyberthreats notwithstanding.

More from

Cyberattack on American Water: A warning to critical infrastructure

3 min read - American Water, the largest publicly traded United States water and wastewater utility, recently experienced a cybersecurity incident that forced the company to disconnect key systems, including its customer billing platform. As the company’s investigation continues, there are growing concerns about the vulnerabilities that persist in the water sector, which has increasingly become a target for cyberattacks. The breach is a stark reminder of the critical infrastructure risks that have long plagued the industry. While the water utility has confirmed that…

What’s behind unchecked CVE proliferation, and what to do about it

4 min read - The volume of Common Vulnerabilities and Exposures (CVEs) has reached staggering levels, placing immense pressure on organizations' cyber defenses. According to SecurityScorecard, there were 29,000 vulnerabilities recorded in 2023, and by mid-2024, nearly 27,500 had already been identified.Meanwhile, Coalition's 2024 Cyber Threat Index forecasts that the total number of CVEs for 2024 will hit 34,888—a 25% increase compared to the previous year. This upward trend presents a significant challenge for organizations trying to manage vulnerabilities and mitigate potential exploits.What’s behind…

Quishing: A growing threat hiding in plain sight

4 min read - Our mobile devices go everywhere we go, and we can use them for almost anything. For businesses, the accessibility of mobile devices has also made it easier to create more interactive ways to introduce new products and services while improving user experiences across different industries. Quick-response (QR) codes are a good example of this in action and help mobile devices quickly navigate to web pages or install new software by simply scanning an image.However, legitimate organizations aren’t the only ones…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today